Network Instruments white paper

Size: px
Start display at page:

Download "Network Instruments white paper"

Transcription

1 Network Instruments white paper ANALYZING FULL-DUPLEX NETWORKS There are a number ways to access full-duplex traffic on a network for analysis: SPAN or mirror ports, aggregation TAPs (Test Access Ports), or full-duplex TAPs are the three most common. This paper discusses the issues involved in deciding which type of technology to deploy. In short, your answer will depend on the rate of traffic being monitored, and the level of visibility you require.

2 OVERVIEW This paper describes the advantages and disadvantages of three common methods of accessing traffic from full-duplex networks for purposes of analysis, monitoring, or forensics: Attaching a monitoring or analysis device to a switch s analyzer port (in Cisco terminology, a Switch Port Analyzer, or SPAN) to monitor a full-duplex link. Because this setup uses standard full-duplex connectors (one channel transmits, the other receives) on both the switch and the analysis device, it creates a potential bottleneck when trying to mirror both sides of a full-duplex link to the analyzer s single receive channel. Attaching a monitoring or analysis device to an aggregation TAP inserted into a full-duplex link. As with a SPAN, the aggretator TAP copies both sides of a full-duplex link to the analyzer s single receive channel. Its use of buffering makes it somewhat better able to keep up with high traffic levels than a SPAN. Attaching a dual-recieve monitoring or analysis device to a full-duplex TAP inserted into a full-duplex link. Dual-receive means that the network card on the analysis device has two receive channels rather than the transmit and receive channels associated with a standard full-duplex link. Each approach has advantages and disadvantages. SPANs and aggregation TAPs allow the use a of standard (and usually less expensive) network card on the analysis device, but their limitations make them less than ideal for situations where it is necessary to guarantee the visibility of every packet on the wire. A full-duplex TAP is the ideal solution for monitoring full-duplex networks utilized at more than 50 percent, but their design requires that the analyzer be a specialized device with a dual-receive capture interface that is capable of capturing the TAP s output and rebuilding the data for analysis. INTRODUCTION Whether you are monitoring a network for security threats or capturing and decoding packets while troubleshooting, you need a reliable way to see the network traffic. Traffic levels on the given segment, coupled with how much visibility you require will suggest the most economical solution. There are three common ways for an analysis device to capture traffic from a network: SPAN The advantage to the SPAN port solution is its cost, as this feature is included for free with virtually every managed switch on the market. A SPAN is also remotely configurable, allowing you to change which ports are mirrored from any system connected to the switch. 2

3 The limitation with a SPAN or port mirror stems from the aggregation that must take place to merge full-duplex network traffic in to a single receive channel on the analyzer. Therefore when traffic levels on the network exceed the output capability of the SPAN, the switch is forced to drop packets. Another reason that a port mirror may not be the right choice is because layer 1 and 2 errors are not mirrored, and therefore never reach the analyzer. When troubleshooting, seeing these errors can be important. AGGREGATION TAP An aggregation TAP makes a good compromise between the SPAN and full-duplex TAP options. It costs more than a full-duplex TAP due to the added complexity and memory requirements of its built-in buffer. But it does not require a specialized (and potentially more expensive) dual-receive capture interface on the analysis device. Like a full-duplex TAP, it is independent of the network, making it invulnerable to security threats. An aggregation TAP includes an internal memory buffer to mitigate the bandwidth problem associated with converging both sides of the full-duplex traffic from the network into one side of the full-duplex link to the analyzer. The buffer is able to cache some spikes in network utilization, but it drops packets when the bursts of activity exceed buffer capacity. Although some aggregation TAPs pass along layer 1 and 2 errors, all aggregation TAPs can drop packets under heavy network utilization. FULL-DUPLEX TAP A full-duplex TAP is the only method of the three alternatives that will guarantee that all of the network traffic, including layer 1 and 2 error information, makes it to the analysis device. It is more complex and potentially expensive to implement, but where there is high network utilization and it is important to guarantee it captures everything on the wire along with errors from all network layers, a full-duplex TAP is the only choice. USING A SPAN OR PORT MIRROR When monitoring a full-duplex link through a SPAN or mirror port on a switch, the switch does three things: 1. Copies both the send and receive data channels 2. Reconstructs an integrated data stream from the two channels 3. Routes the integrated signal to the send channel of the SPAN or mirror port 3

4 Each of these activities burdens the switch s internal processor. These demands on the switch s CPU have implications for both your monitoring equipment and general network performance. Using a SPAN or port mirror to capture network traffic for analysis presents the following risks: As total bandwidth usage for both channels exceeds the capacity of the outbound (analyzer) link, the excess traffic is dropped from the outbound stream. There simply is not enough bandwidth to transmit both sides of the full-duplex traffic across a single standard interface. The switch s CPU must act as both a network switch and a packet-copier. The switch s CPU must also integrate the two data streams (send and receive) together correctly. Both packet copy/re-direction and channel integration is affected by switch load. This means the SPAN or mirror port may not deliver accurate captures when the switch is under heavy load. Monitoring a 10/100 network through a gigabit SPAN or mirror port and analyzer does not alleviate these concerns. Also, there is no notification when the SPAN or mirror port is dropping packets or delivering inaccurate time stamps. When analyzing traffic through a SPAN port, the switch s CPU copies the full-duplex signal, integrating RX & TX into one TX signal, routed to the SPAN port. Server Traffic potential (Mb): 1000 (TX) (RX) 2000 (full-duplex) Switch Maximum analysis RX bandwidth: 1000 Mbps Analysis Device A SPAN or mirror port can deliver satisfactory results when used to monitor lightly used, non-critical networks. If network utilization exceeds the capacity of the outbound (analyzer) link, packet loss results which invalidates many types of analysis, and makes monitoring for certain kinds of network activity impossible. For example, you might miss a virus signature because packets are being dropped. When analyzing a transaction or connection problem, the analyzer may detect problems where none exist because expected packets are being dropped by the SPAN. Hardware and media errors will also be impossible to troubleshoot through a SPAN, as layer 2 errors are not mirrored. 4

5 USING AN AGGREGATION TAP An aggregation TAP is much like a small switch dedicated to mirroring a link for analysis. Its advantage over a SPAN is that the aggregation TAP buffers the analyzer output, which makes it less likely than a SPAN to drop packets during short spikes of high usage. Under sustained high utilization (over 50%), an aggregation TAP will drop packets. An aggregation TAP is not an addressable device, and therefore not vulnerable to security threats. An aggregation TAP is ideally suited to work with an analysis device with a standard (single-receive) capture interface. This means that a laptop or a standard system can be deployed as an analysis device, rather than the more expensive specialized analyzers or appliances that are designed to accept full duplex traffic via a dualreceive capture interface. Just like a SPAN, an aggregation TAP is ideal for a lightly used network that occasionally has utilization peaks above the capture capacity of the analyzer. Unlike a SPAN, the aggregation TAP will forward layer 1 and 2 errors to the analysis device. Another advantage the aggregation TAP has over a SPAN or port mirror session is its internal memory buffer, most commonly 256 or 512MB. The memory buffer provides limited protection against packet loss, and if the network utilization does not regularly exceed the capacity of the analyzer s capture card, an aggregation TAP may be the right choice. It is important to understand that once the buffer is full, an aggregation TAP will drop packets. The graph below is meant to give some idea how long a spike in utilization can be absorbed before packets are dropped. Buffer effectiveness at different traffic levels Length of time before buffer drops packets (seconds) % % Buffer size in MB % 80% % Bandwidth Utilization % 8.2 PLEASE NOTE: The role of the buffer is to absorb traffic spikes of over 50% fullduplex bandwidth saturation, because the analyzer s single-receive interface simply cannot move the bits fast enough to keep up at line rate. The data in the buffer is released when utilization drops to the point where the analysis interface can move both the live data plus the data released from the buffer. Packet loss is unavoidable if the utilization spikes exceed the capacity of the buffer. 5

6 USING A FULL-DUPLEX TAP A full-duplex TAP is a passive mechanism that is installed between two full-duplex network devices. TAPs are available for monitoring optical or copper at different speeds (10/100/1000 for copper and up to 10Gb for optical). An optical TAP is non-electronic (no power) and optically splits the full-duplex signal into two fullduplex signals. One signal maintains the network link, while the other is passed to the analysis or monitoring appliance equipped with a dual-receive capture card. A copper TAP performs the same function, but uses electronic circuitry to duplicate the signals. Because a full-duplex TAP copies both the send and receive channels from a full-duplex link to the analyzer (where the data is integrated), the analyzer can monitor a full-duplex network at line rate, assuming the capture card in the analyzer is capable of keeping up. A full-duplex TAP must be coupled with a probe or monitoring device capable of receiving both channels of a full-duplex signal and recombining the two channels back into a full-duplex data stream. Although this can be the most expensive solution, it is also the only solution that guarantees complete accuracy even when the network is 100 percent saturated. A TAP delivers both TX and RX signals separately, providing a pass-through signal for network traffic, and a full-duplex, line-rate signal to an analysis device. Server Dual-receive analyzer receives both sides of the full-duplex link, with no error filtering or packet loss Switch Analysis Device CONCLUSION The appropriate solution for capturing full-duplex data for analysis depends on the rates of traffic you must monitor, and what level of visiblity you require. When monitoring a lightly-used network, using a SPAN or aggregation TAP to supply an analysis device with a standard full-duplex (i.e., single-receive) interface can be an economical choice. The aggregation TAP can provide some protection against packet loss, but if usage spikes exceed its buffer capacity, the aggregation TAP will drop packets. 6

7 To monitor a critical, heavily utilized full-duplex link, a full-duplex TAP is the only failsafe alternative. Monitoring a full-duplex connection using a full-duplex TAP and an analyzer with a dual-receive capture interface guarantees complete, full-duplex capture for monitoring, analysis, and intrusion detection regardless of bandwidth saturation. North American Location Red Circle Drive Minnetonka, MN USA Toll Free: (800) Voice: (952) Network Instruments. All rights reserved. Network Instruments and all associated logos are trademarks or registered trademarks of Network Instruments, a JDSU Performance Management Solution. All other trademarks, registered or unregistered, are sole property of their respective owners. WP V17-B1

Analyzing Full-Duplex Networks

Analyzing Full-Duplex Networks Analyzing Full-Duplex Networks There are a number ways to access full-duplex traffic on a network for analysis: SPAN or mirror ports, aggregation TAPs (Test Access Ports), or full-duplex TAPs are the three

More information

ntap Product Family Provides monitoring and security devices with complete visibility into full-duplex networks

ntap Product Family Provides monitoring and security devices with complete visibility into full-duplex networks ntap Product Family Provides monitoring and security devices with complete visibility into full-duplex networks Network Instruments ntaps let you monitor and analyze full-duplex links. ntaps are critical

More information

Best Practices in Gigabit Capture

Best Practices in Gigabit Capture Network Instruments White Paper Best Practices in Gigabit Capture How to obtain accurate, line-rate captures with your gigabit investment Analysis is a necessary component of network management. Understanding

More information

Observer Analysis Advantages

Observer Analysis Advantages In-Depth Analysis for Gigabit and 10 Gb Networks For enterprise management, gigabit and 10 Gb Ethernet networks mean high-speed communication, on-demand systems, and improved business functions. For enterprise

More information

Observer Probe Family

Observer Probe Family Observer Probe Family Distributed analysis for local and remote networks Monitor and troubleshoot vital network links in real time from any location Network Instruments offers a complete line of software

More information

Observer Probe Family

Observer Probe Family Observer Probe Family Distributed analysis for local and remote networks Monitor and troubleshoot vital network links in real time from any location Network Instruments offers a complete line of software

More information

Deploying Probes and Analyzers in an Enterprise Environment

Deploying Probes and Analyzers in an Enterprise Environment Network Instruments White Paper Deploying Probes and Analyzers in an Enterprise Environment As an IT manager, you need visibility into every corner of the network, from the edge to the core. A distributed

More information

Choosing Tap or SPAN for Data Center Monitoring

Choosing Tap or SPAN for Data Center Monitoring Choosing Tap or SPAN for Data Center Monitoring Technical Brief Key Points Taps are passive, silent, and deliver a perfect record of link traffic, but require additional hardware and create a point of

More information

Network Instruments white paper

Network Instruments white paper Network Instruments white paper USING A NETWORK ANALYZER AS A SECURITY TOOL Network Analyzers are designed to watch the network, identify issues and alert administrators of problem scenarios. These features

More information

Net Optics Learning Center Presents The Fundamentals of Passive Monitoring Access

Net Optics Learning Center Presents The Fundamentals of Passive Monitoring Access Net Optics Learning Center Presents The Fundamentals of Passive Monitoring Access 1 The Fundamentals of Passiv e Monitoring Access Copy right 2006 Net Optics, Inc. Agenda Goal: Present an overview of Tap

More information

Network Instruments white paper

Network Instruments white paper Network Instruments white paper MONITORING SERVICE DELIVERY IN AN MPLS ENVIRONMENT A growing number of enterprises depend on (or are considering) MPLS-based routing to guarantee highbandwidth capacity

More information

Any-to-any switching with aggregation and filtering reduces monitoring costs

Any-to-any switching with aggregation and filtering reduces monitoring costs Any-to-any switching with aggregation and filtering reduces monitoring costs Summary Physical Layer Switches can filter and forward packet data to one or many monitoring devices. With intuitive graphical

More information

Application and Network Performance Monitoring in a Virtualized Environment

Application and Network Performance Monitoring in a Virtualized Environment Application and Performance Monitoring in a Virtualized Environment As organizations implement virtualized environments, knowing how to monitor and maintain them becomes yet another challenge for today

More information

Net Optics and Cisco NAM

Net Optics and Cisco NAM When Cisco decided to break its Network Analysis Module (NAM) out of the box and into a stand-alone appliance, they turned to Net Optics for monitoring access connectivity. Cisco NAM 2200 Series Cisco

More information

Monitoring Service Delivery in an MPLS Environment

Monitoring Service Delivery in an MPLS Environment Monitoring Service Delivery in an MPLS Environment A growing number of enterprises depend on (or are considering) MPLS-based routing to guarantee high-bandwidth capacity for the real-time applications

More information

Network Instruments white paper

Network Instruments white paper Network Instruments white paper EXTENDING NETWORK VISIBILITY BY LEVERAGING NETFLOW AND SFLOW TECHNOLOGIES This paper shows how a network analyzer that can leverage and sflow technologies can provide extended

More information

Network Monitoring and Analysis Techniques Using Taps and SPAN Switches

Network Monitoring and Analysis Techniques Using Taps and SPAN Switches Network Monitoring and Analysis Techniques Using Taps and SPAN Switches Networks have evolved into complex structures supporting critical business processes and communications. As this complexity has increased,

More information

Observer Analyzer Provides In-Depth Management

Observer Analyzer Provides In-Depth Management Comprehensive Wireless Network Management Made Simple From deploying access points to baselining activity to enforcing corporate security policies, the Observer Performance Management Platform is a complete,

More information

Network Management and Monitoring Software

Network Management and Monitoring Software Page 1 of 7 Network Management and Monitoring Software Many products on the market today provide analytical information to those who are responsible for the management of networked systems or what the

More information

A-7: SPAN Out of the Box Wednesday June 16, 2010 1:15 pm 2:45 pm

A-7: SPAN Out of the Box Wednesday June 16, 2010 1:15 pm 2:45 pm A-7: SPAN Out of the Box Wednesday June 16, 2010 1:15 pm 2:45 pm John HE, Hardware Engineer Founder Dualcomm Technology, Inc. SHARKFEST 10 Stanford University June 14-17, 2010 Outline This presentation

More information

Extending Network Visibility by Leveraging NetFlow and sflow Technologies

Extending Network Visibility by Leveraging NetFlow and sflow Technologies Extending Network Visibility by Leveraging and sflow Technologies This paper shows how a network analyzer that can leverage and sflow technologies can provide extended visibility into enterprise networks

More information

Smart Network Access System SmartNA 10 Gigabit Aggregating Filtering TAP

Smart Network Access System SmartNA 10 Gigabit Aggregating Filtering TAP Smart Network Access System SmartNA 10 Gigabit Aggregating Filtering TAP Gain Access and Visibility to your 10 Gigabit Links Today! 10 Gigabit SR or LR Passive Optical TAP or connect two (2) 10 Gigabit

More information

Installation Guide for GigaBit Fiber Port Aggregator Tap with SFP Monitor Ports

Installation Guide for GigaBit Fiber Port Aggregator Tap with SFP Monitor Ports Installation Guide for GigaBit Fiber Port Aggregator Tap with SFP Monitor Ports (800-0037) Doc. PUBTPASXSFPU Rev., 07/08 Contents Introduction.... Key Features... Unpacking and Inspection....3 Product

More information

Network Agent Quick Start

Network Agent Quick Start Network Agent Quick Start Topic 50500 Network Agent Quick Start Updated 17-Sep-2013 Applies To: Web Filter, Web Security, Web Security Gateway, and Web Security Gateway Anywhere, v7.7 and 7.8 Websense

More information

Cisco Bandwidth Quality Manager 3.1

Cisco Bandwidth Quality Manager 3.1 Cisco Bandwidth Quality Manager 3.1 Product Overview Providing the required quality of service (QoS) to applications on a wide-area access network consistently and reliably is increasingly becoming a challenge.

More information

White Paper. Intrusion Detection Deploying the Shomiti Century Tap

White Paper. Intrusion Detection Deploying the Shomiti Century Tap White Paper Intrusion Detection Deploying the Shomiti Century Tap . Shomiti Tap Deployment Purpose of this Paper The scalability of Intrusion Detection Systems (IDS) is often an issue when deploying an

More information

Network Performance Channel

Network Performance Channel Network Performance Channel Net Optics Products Overview MIHAJLO PRERAD, Network Performance Channel GmbH Who we are Network Performance Channel GmbH Leading global value added distributor specialized

More information

WHITE PAPER. Best Practices for Eliminating Duplicate Packets

WHITE PAPER. Best Practices for Eliminating Duplicate Packets WHITE PAPER Best Practices for Eliminating Duplicate Packets 26601 Agoura Road, Calabasas, CA 91302 Tel: 818.871.1800 Fax: 818.871.1805 www.ixiacom.com 915-6501-01 Rev. B, July 2013 Table of Contents

More information

Enhanced Visibility, Improved ROI

Enhanced Visibility, Improved ROI Abstract Enhanced Visibility, Improved ROI The IT Security/Network Infrastructure Management departments within an organization have access to some of the richest and most useful enterprise data. Because

More information

Are Duplicate Packets Interfering with Network Monitoring? White Paper

Are Duplicate Packets Interfering with Network Monitoring? White Paper Are Duplicate Packets Interfering with Network Monitoring? White Paper A network monitoring switch allows IT teams to simultaneously connect a wide array of monitoring tools. The best-in-class network

More information

Quick Start for Network Agent. 5-Step Quick Start. What is Network Agent?

Quick Start for Network Agent. 5-Step Quick Start. What is Network Agent? What is Network Agent? The Websense Network Agent software component uses sniffer technology to monitor all of the internet traffic on the network machines that you assign to it. Network Agent filters

More information

Secure Access Complete Visibility

Secure Access Complete Visibility PACKET CAPTURE APPLIANCE PACKET CAPTURE APPLIANCE PACKET CAPTURE APPLIANCE PACKET CAPTURE APPLIANCE Intrusion Detection Switch TAP Data Recorder VoIP Analyzer Switch Secure Access Complete Visibility Web

More information

Network Instruments white paper

Network Instruments white paper Network Instruments white paper RETROSPECTIVE NETWORK ANALYSIS Unified Communications (UC) and other bandwidth-intensive applications can greatly increase network performance requirements. Network professionals

More information

WHITE PAPER. Network Traffic Port Aggregation: Improved Visibility, Security, and Efficiency

WHITE PAPER. Network Traffic Port Aggregation: Improved Visibility, Security, and Efficiency WHITE PAPER Network Traffic Port Aggregation: Improved Visibility, Security, and Efficiency www.ixiacom.com 915-6893-01 Rev. A, July 2014 2 Table of Contents Summary... 4 Introduction... 4 Differing Goals

More information

Scalable. Reliable. Flexible. High Performance Architecture. Fault Tolerant System Design. Expansion Options for Unique Business Needs

Scalable. Reliable. Flexible. High Performance Architecture. Fault Tolerant System Design. Expansion Options for Unique Business Needs Protecting the Data That Drives Business SecureSphere Appliances Scalable. Reliable. Flexible. Imperva SecureSphere appliances provide superior performance and resiliency for demanding network environments.

More information

Enabling a Converged World. Are Duplicate Packets Interfering with Network Monitoring?

Enabling a Converged World. Are Duplicate Packets Interfering with Network Monitoring? Enabling a Converged World Are Duplicate Packets Interfering with Network Monitoring? 915-6510-01 Rev A December 2011 Contents Overview...3 Duplicate Packets Diminish Monitoring Port Bandwidth...4 Duplicate

More information

Benefits of WAN-Level Visibility in Monitoring and Maintaining your Network

Benefits of WAN-Level Visibility in Monitoring and Maintaining your Network Benefits of WAN-Level Visibility in Monitoring and Maintaining your Network A WAN Analyzer offers essential insight into your WAN links, including Service Level Agreement verification, WAN frame visibility,

More information

VMWARE WHITE PAPER 1

VMWARE WHITE PAPER 1 1 VMWARE WHITE PAPER Introduction This paper outlines the considerations that affect network throughput. The paper examines the applications deployed on top of a virtual infrastructure and discusses the

More information

Installation Guide for. 10/100 to Triple-speed Port Aggregator. Model TPA-CU. 800-0045-001 Doc. PUBTPACUU Rev. 1, 12/08. In-Line

Installation Guide for. 10/100 to Triple-speed Port Aggregator. Model TPA-CU. 800-0045-001 Doc. PUBTPACUU Rev. 1, 12/08. In-Line Installation Guide for 10/100 to Triple-speed Port Aggregator Model TPA-CU In-Line 800-0045-001 Doc. PUBTPACUU Rev. 1, 12/08 Contents Introduction.....................................................

More information

Beyond Monitoring Root-Cause Analysis

Beyond Monitoring Root-Cause Analysis WHITE PAPER With the introduction of NetFlow and similar flow-based technologies, solutions based on flow-based data have become the most popular methods of network monitoring. While effective, flow-based

More information

Efficient Network Monitoring Access

Efficient Network Monitoring Access Abstract Organizations that rely on the reliability, security, and performance of their networks can no longer afford to wait for outages or security breaches to occur before installing test access points.

More information

Managing Application Delivery from the User s Perspective

Managing Application Delivery from the User s Perspective Managing Application Delivery from the User s Perspective Essential Monitoring Capabilities and Metrics for Assessing End-User Experience Network managers are tasked with monitoring end-user experience,

More information

Scalable. Reliable. Flexible. High Performance Architecture. Fault Tolerant System Design. Expansion Options for Unique Business Needs

Scalable. Reliable. Flexible. High Performance Architecture. Fault Tolerant System Design. Expansion Options for Unique Business Needs Protecting the Data That Drives Business SecureSphere Appliances Scalable. Reliable. Flexible. Imperva SecureSphere appliances provide superior performance and resiliency for demanding network environments.

More information

Taps vs. SPAN The Forest AND the Trees: Full Visibility into Today's Networks

Taps vs. SPAN The Forest AND the Trees: Full Visibility into Today's Networks WHITE PAPER Taps vs. SPAN The Forest AND the Trees: Full Visibility into Today's Networks www.ixiacom.com 915-3534-01 Rev. A, September 2015 2 Table of Contents The First Line of Defense: Access... 5 Problem

More information

USER EXPERIENCE: 5 ESSENTIAL MONITORING METRICS

USER EXPERIENCE: 5 ESSENTIAL MONITORING METRICS USER EXPERIENCE: 5 ESSENTIAL MONITORING METRICS Network teams are increasingly being told by management to track and manage the end user s experience without any clear guidance as to its meaning. In this

More information

Quick Start for Network Agent. 5-Step Quick Start. What is Network Agent?

Quick Start for Network Agent. 5-Step Quick Start. What is Network Agent? What is Network Agent? Websense Network Agent software monitors all internet traffic on the machines that you assign to it. Network Agent filters HTTP traffic and more than 70 other popular internet protocols,

More information

OptiView. Total integration Total control Total Network SuperVision. Network Analysis Solution. No one knows the value of an

OptiView. Total integration Total control Total Network SuperVision. Network Analysis Solution. No one knows the value of an No one knows the value of an Network Analysis Solution Total integration Total control Total Network SuperVision integrated solution better than network engineers and Fluke Networks. Our Network Analysis

More information

3. MONITORING AND TESTING THE ETHERNET NETWORK

3. MONITORING AND TESTING THE ETHERNET NETWORK 3. MONITORING AND TESTING THE ETHERNET NETWORK 3.1 Introduction The following parameters are covered by the Ethernet performance metrics: Latency (delay) the amount of time required for a frame to travel

More information

OptiView. Total integration Total control Total Network SuperVision. Network Analysis Solution. No one knows the value of an

OptiView. Total integration Total control Total Network SuperVision. Network Analysis Solution. No one knows the value of an No one knows the value of an Network Analysis Solution Total integration Total control Total Network SuperVision integrated solution better than network engineers and Fluke Networks. Our Network Analysis

More information

Technical Bulletin. Enabling Arista Advanced Monitoring. Overview

Technical Bulletin. Enabling Arista Advanced Monitoring. Overview Technical Bulletin Enabling Arista Advanced Monitoring Overview Highlights: Independent observation networks are costly and can t keep pace with the production network speed increase EOS eapi allows programmatic

More information

Observer Reporting Server Sample Executive Reports

Observer Reporting Server Sample Executive Reports Observer Reporting Server Sample Executive Reports Enterprise-wide monitoring and reporting with root-cause analysis Table of Contents Observer Reporting Server Introduction to the Observer Reporting Server

More information

Security is one of the biggest concerns today. Ever since the advent of the 21 st century, the world has been facing several challenges regarding the security of people, economy, and infrastructure. One

More information

Question: 3 When using Application Intelligence, Server Time may be defined as.

Question: 3 When using Application Intelligence, Server Time may be defined as. 1 Network General - 1T6-521 Application Performance Analysis and Troubleshooting Question: 1 One component in an application turn is. A. Server response time B. Network process time C. Application response

More information

3 Steps to Server Virtualization Visibility

3 Steps to Server Virtualization Visibility 3 Steps to Server Virtualization Visibility Each enterprise has its own reasons for moving to virtual infrastructure, but it all boils down to the demand for better and more efficient server utilization.

More information

Unified network traffic monitoring for physical and VMware environments

Unified network traffic monitoring for physical and VMware environments Unified network traffic monitoring for physical and VMware environments Applications and servers hosted in a virtual environment have the same network monitoring requirements as applications and servers

More information

QRadar Security Intelligence Platform Appliances

QRadar Security Intelligence Platform Appliances DATASHEET Total Security Intelligence An IBM Company QRadar Security Intelligence Platform Appliances QRadar Security Intelligence Platform appliances combine typically disparate network and security management

More information

Deploying Network Taps for improved security

Deploying Network Taps for improved security DATACOM SYSTEMS INC Deploying Network Taps for improved security A guide to improving security visibility A DATACOM SYSTEMS WHITE PAPER Improve Visibility A network security detection and prevention scheme

More information

Redefine Network Visibility in the Data Center with the Cisco NetFlow Generation Appliance

Redefine Network Visibility in the Data Center with the Cisco NetFlow Generation Appliance White Paper Redefine Network Visibility in the Data Center with the Cisco NetFlow Generation Appliance What You Will Learn Modern data centers power businesses through a new generation of applications,

More information

5 IPTV MONITORING BEST PRACTICES

5 IPTV MONITORING BEST PRACTICES 5 IPTV MONITORING BEST PRACTICES Chances are you ve seen Internet Protocol TV (IPTV) but didn t know it. Different types of IPTV are popping up in our daily lives ranging from Video-On-Demand to being

More information

Is flow control necessary?

Is flow control necessary? Is flow control necessary? In this white paper we will explain the concept of the Ethernet switch buffer and flow control. H y p e r c a b l e 8 1 r u e d e s C a r r i è r e s P a r c l a R o n z e 6

More information

Fail-Safe IPS Integration with Bypass Technology

Fail-Safe IPS Integration with Bypass Technology Summary Threats that require the installation, redeployment or upgrade of in-line IPS appliances often affect uptime on business critical links. Organizations are demanding solutions that prevent disruptive

More information

Troubleshooting LANs with Wirespeed Packet Capture and Expert Analysis

Troubleshooting LANs with Wirespeed Packet Capture and Expert Analysis Application Note Troubleshooting LANs with Wirespeed Packet Capture and Expert Analysis Introduction This application note is one in a series of local area network (LAN) troubleshooting papers from JDSU

More information

Windows Server Performance Monitoring

Windows Server Performance Monitoring Spot server problems before they are noticed The system s really slow today! How often have you heard that? Finding the solution isn t so easy. The obvious questions to ask are why is it running slowly

More information

Configuring SPAN and RSPAN

Configuring SPAN and RSPAN CHAPTER 23 This chapter describes how to configure Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) on the Catalyst 2960 switch. Note For complete syntax and usage information for the commands used

More information

Tool Optimization. Benefits. Introduction. Technical Brief. Extend the usage life of tools and avoid costly upgrades

Tool Optimization. Benefits. Introduction. Technical Brief. Extend the usage life of tools and avoid costly upgrades Tool Optimization Technical Brief Benefits Extend the usage life of tools and avoid costly upgrades Increase the accuracy and results of data analysis Extend capacity of storage media by optimizing data

More information

Sage 200 Online. System Requirements and Prerequisites

Sage 200 Online. System Requirements and Prerequisites Sage 200 Online System Requirements and Prerequisites v2013 Copyright statement Sage (UK) Limited, 2013. All rights reserved. If this documentation includes advice or information relating to any matter

More information

OptiView. Total integration Total control Total Network SuperVision. Network Analysis Solution. No one knows the value of an

OptiView. Total integration Total control Total Network SuperVision. Network Analysis Solution. No one knows the value of an No one knows the value of an Network Analysis Solution Total integration Total control Total Network SuperVision integrated solution better than network engineers and Fluke Networks. Our Network Analysis

More information

WildPackets engaged Miercom to conduct comprehensive,

WildPackets engaged Miercom to conduct comprehensive, Lab Testing Summary Report January 2014 Report 140109 Key findings and conclusions: Omnipliance TL network analysis appliance with two-port OmniAdapter 10G card proves in testing a capture-to-disk rate

More information

WHITE PAPER. Addressing Monitoring, Access, and Control Challenges in a Virtualized Environment

WHITE PAPER. Addressing Monitoring, Access, and Control Challenges in a Virtualized Environment WHITE PAPER Addressing Monitoring, Access, and Control Challenges in a Virtualized Environment www.ixiacom.com 915-6892-01 Rev. A, July 2014 2 Table of Contents The Challenge of the Virtual Environment...

More information

Network Security Forensics

Network Security Forensics Network Security Forensics As hacking and security threats grow in complexity and organizations face stringent requirements to document access to private data on the network, organizations require a new

More information

WHITE PAPER. Extending Network Monitoring Tool Performance

WHITE PAPER. Extending Network Monitoring Tool Performance WHITE PAPER Extending Network Monitoring Tool Performance www.ixiacom.com 915-6915-01 Rev. A, July 2014 2 Table of Contents Benefits... 4 Abstract... 4 Introduction... 4 Understanding Monitoring Tools...

More information

Network Monitoring White Paper

Network Monitoring White Paper Network ing White Paper ImageStream Internet Solutions, Inc. 7900 East 8th Road Plymouth, Indiana 46563 http://www.imagestream.com info@imagestream.com Phone: 574.935.8484 Sales: 800.813.5123 Fax: 574.935.8488

More information

tap into your network product brochure

tap into your network product brochure tap into your network product brochure Leadership Net Optics is dedicated to helping customers obtain the highest efficiency from their networks. Our products help Network IT and security professionals

More information

Solving Monitoring Challenges in the Data Center

Solving Monitoring Challenges in the Data Center Solving Monitoring Challenges in the Data Center How a network monitoring switch helps IT teams stay proactive White Paper IT teams are under big pressure to improve the performance and security of corporate

More information

technical brief Optimizing Performance in HP Web Jetadmin Web Jetadmin Overview Performance HP Web Jetadmin CPU Utilization utilization.

technical brief Optimizing Performance in HP Web Jetadmin Web Jetadmin Overview Performance HP Web Jetadmin CPU Utilization utilization. technical brief in HP Overview HP is a Web-based software application designed to install, configure, manage and troubleshoot network-connected devices. It includes a Web service, which allows multiple

More information

TIME TO RETHINK PERFORMANCE MONITORING

TIME TO RETHINK PERFORMANCE MONITORING TIME TO RETHINK PERFORMANCE MONITORING New requirements for application awareness and support for unified communications are challenging performance monitoring appliance vendors to reconsider their approach.

More information

Installation Guide for GigaBit Fiber Port Aggregator Tap with SFP Monitor Ports

Installation Guide for GigaBit Fiber Port Aggregator Tap with SFP Monitor Ports Installation Guide for Gigait Fiber Port ggregator Tap with SFP Monitor Ports Doc. PUPDSXSFPU Rev., 08/06 Gigait Fiber Port ggregator Tap Contents Introduction.....................................................

More information

Beyond Monitoring Root-Cause Analysis

Beyond Monitoring Root-Cause Analysis WHITE PAPER With the introduction of NetFlow and similar flow-based technologies, solutions based on flow-based data have become the most popular methods of network monitoring. While effective, flow-based

More information

OmniAnalysis Platform. WAN Analyzer Card PCMCIA T1/E1 Getting Started Guide

OmniAnalysis Platform. WAN Analyzer Card PCMCIA T1/E1 Getting Started Guide OmniAnalysis Platform WAN Analyzer Card PCMCIA T1/E1 Getting Started Guide 2007, WildPackets, Inc. All rights reserved. Information in this document is subject to change without notice. No part of this

More information

White Paper: Deploying Network Taps with Intrusion Detection Systems

White Paper: Deploying Network Taps with Intrusion Detection Systems Executive Summary Network Security is a large and growing area of concern for corporations. CERT Coordination Center records show 294,037 incidents reported between 2000 and 2003, with 137,529 incidents

More information

Promiscuous Monitoring in Ethernet and Wi-Fi Networks

Promiscuous Monitoring in Ethernet and Wi-Fi Networks Promiscuous Monitoring in Ethernet and Wi-Fi Networks Executive Summary This white paper examines the problems related to the deployment and usage of software-based network monitoring solutions in wired

More information

IP Office Technical Tip

IP Office Technical Tip IP Office Technical Tip Tip no: 195 Release Date: October 26, 2007 Region: GLOBAL Using Packet Capture Software To Verify IP Network VoIP Quality Of Service (QoS) Operation Converged networks can experience

More information

PT100 Portable TAP. User Guide. Revision 1.0

PT100 Portable TAP. User Guide. Revision 1.0 PT100 Portable TAP User Guide Revision 1.0 Contents Chapter 1 Preface 2 Introduction........................................................................................... 2 Product Features and Benefits............................................................................

More information

SNMP Monitoring: One Critical Component to Network Management

SNMP Monitoring: One Critical Component to Network Management Network Instruments White Paper SNMP Monitoring: One Critical Component to Network Management Although SNMP agents provide essential information for effective network monitoring and troubleshooting, SNMP

More information

10 Port L2 Managed Gigabit Ethernet Switch with 2 Open SFP Slots - Rack Mountable

10 Port L2 Managed Gigabit Ethernet Switch with 2 Open SFP Slots - Rack Mountable 10 Port L2 Managed Gigabit Ethernet Switch with 2 Open SFP Slots - Rack Mountable StarTech ID: IES101002SFP The IES101002SFP 10-port Ethernet switch delivers flexibility and control of your network by

More information

IREBOX X. Firebox X Family of Security Products. Comprehensive Unified Threat Management Solutions That Scale With Your Business

IREBOX X. Firebox X Family of Security Products. Comprehensive Unified Threat Management Solutions That Scale With Your Business IREBOX X IREBOX X Firebox X Family of Security Products Comprehensive Unified Threat Management Solutions That Scale With Your Business Family of Security Products Comprehensive unified threat management

More information

WHITE PAPER. WEP Cloaking for Legacy Encryption Protection

WHITE PAPER. WEP Cloaking for Legacy Encryption Protection WHITE PAPER WEP Cloaking for Legacy TM Encryption Protection Introduction Wired Equivalent Privacy (WEP) is the encryption protocol defined in the original IEEE 802.11 standard for Wireless Local Area

More information

Edge Configuration Series Reporting Overview

Edge Configuration Series Reporting Overview Reporting Edge Configuration Series Reporting Overview The Reporting portion of the Edge appliance provides a number of enhanced network monitoring and reporting capabilities. WAN Reporting Provides detailed

More information

MICROSOFT LYNC 101: ENSURE UC EVERYTHING

MICROSOFT LYNC 101: ENSURE UC EVERYTHING MICROSOFT LYNC 101: ENSURE UC EVERYTHING Although the Microsoft Lync platform is somewhat of a newcomer to the unified communications world, it has turned a lot of network heads. Teams with significant

More information

Enhancing Cisco Networks with Gigamon // White Paper

Enhancing Cisco Networks with Gigamon // White Paper Across the globe, many companies choose a Cisco switching architecture to service their physical and virtual networks for enterprise and data center operations. When implementing a large-scale Cisco network,

More information

Network Analysis Modules

Network Analysis Modules CHAPTER 6 This chapter describes the (NAMs) and contains the following sections: Network Analysis Module (WS-SVC-NAM-1), page 6-2 Network Analysis Module (WS-SVC-NAM-2), page 6-4 NAMs monitor and analyze

More information

Active Visibility for Multi-Tiered Security // Solutions Overview

Active Visibility for Multi-Tiered Security // Solutions Overview Introduction Cyber threats are becoming ever more sophisticated and prevalent. Traditional security approaches such as firewalls and anti-virus protection are not equipped to mitigate and manage modern

More information

RECORDING VoIP TRAFFIC via PORT MIRRORING

RECORDING VoIP TRAFFIC via PORT MIRRORING Recording. Solutions. Redefined. OrecX will easily record your VoIP traffic once your VoIP traffic is seen on the server interface. Use (SPAN, port spanning or port monitoring) to get the right traffic

More information

Bridgit Conferencing Software: Security, Firewalls, Bandwidth and Scalability

Bridgit Conferencing Software: Security, Firewalls, Bandwidth and Scalability Bridgit Conferencing Software: Security, Firewalls, Bandwidth and Scalability Overview... 3 Installing Bridgit Software... 4 Installing Bridgit Software Services... 4 Creating a Server Cluster... 4 Using

More information

Extending Network Visibility by Leveraging NetFlow and sflow Technologies

Extending Network Visibility by Leveraging NetFlow and sflow Technologies Extending Network Visibility by Leveraging and sflow Technologies This paper shows how a network analyzer that can leverage and sflow technologies can provide extended visibility into enterprise networks

More information

Cisco IPS Manager Express

Cisco IPS Manager Express Cisco IPS Manager Express Product Overview Intrusion prevention systems (IPSs) are critical to protecting your network and assets against worms, Trojans, and other malicious attacks. Cisco IPS Manager

More information

Installation Guide for. 10/100BaseT Port Aggregator Tap with Active Response. Models PA-CU-AR, PAD-CU-AR. Doc. PUBPACUARU Rev.

Installation Guide for. 10/100BaseT Port Aggregator Tap with Active Response. Models PA-CU-AR, PAD-CU-AR. Doc. PUBPACUARU Rev. Installation Guide for /0BaseT Port Aggregator Tap with Active Response Models PA-CU-AR, PAD-CU-AR Doc. PUBPACUARU Rev. 1, 06/06 /0 Port Aggregator Tap Contents Introduction.....................................................

More information

Architecture Overview

Architecture Overview Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and

More information

Traffic Analysis With Netflow. The Key to Network Visibility

Traffic Analysis With Netflow. The Key to Network Visibility Summary Today, Enterprises know that the WAN is one of their most important assets. It needs to be up and running 24x7 for the enterprise to function smoothly. To make this possible, IT administrators

More information

domain is known as the high side, and the less secure domain is the low side. Depending on the application, the

domain is known as the high side, and the less secure domain is the low side. Depending on the application, the Data diodes refer to unidirectional network links used in some high-security network architectures. This paper explains how data diodes are used to secure information and protect against intrusions; it

More information